Mobile Security · Stat
80%
of mobile apps have at least one high-risk security vulnerability.
Most go undetected until after a breach.
Book a Free Mobile Pentest →
~/homeservicesmobile-app-pentest
03.2 · Mobile App Penetration Testing

Beyond the screen.
Inside the binary.

iOS and Android apps tested where they actually run: on rooted devices with Frida instrumentation, decompiled binaries, intercepted TLS, and a full pass over the backend API they depend on. The way real attackers operate.

Platforms
iOS · Android
Coverage
App + API
Standard
OWASP MASVS
09:41 5G
com.client.app
ClientPay
v4.2.1 · under analysis
Frida injected · pid 5234
01 / Two Surfaces, One Engagement

The app on the phone.
The API behind it.

A mobile app is two systems pretending to be one. We test both, because attackers will too.

APP LAYER

The Binary & Runtime

// Where the app actually lives.

We decompile the IPA/APK, instrument the runtime with Frida, inspect on-device storage, and probe everything the OS lets the app touch. This is where insecure storage, weak crypto, and bypassable protections hide.

  • IPA/APK reverse engineering (Hopper, JADX, Ghidra)
  • Runtime hooking with Frida & Objection
  • SSL/cert pinning & root-detect bypass
  • Keychain · Keystore · SQLite inspection
  • Inter-process communication (IPC) abuse
  • Binary protection & obfuscation audit
API LAYER

The Backend It Talks To

// Where the data actually moves.

Mobile apps are thin clients to an API, and that API is where most real breaches happen. We intercept every call, fuzz inputs, abuse authentication, and run the same OWASP API Top 10 sweep we use on any web backend.

  • TLS interception (Burp, mitmproxy)
  • OWASP API Top 10 (BOLA, BFLA, mass assignment)
  • Token tampering · JWT · OAuth flows
  • Rate limiting & abuse-resistance testing
  • Server-side business logic flaws
  • Webhook & push notification security
02 / Platform Coverage

Two ecosystems. Both probed deeply.

Each platform brings its own attack surface. We don't generalize. We test natively.

01iOS
Swift · Objective-C · SwiftUI
02Android
Kotlin · Java · Jetpack Compose
Our toolchain · iOS
FridaObjectionHopperGhidrar2fridaKeychain Dumper
$ frida -U -f com.client.app -l hooks.js
[*] attached to com.client.app · pid 5234
[+] SSL pinning bypassed
[+] Root/JB detection patched
[!] Biometric flow callback hooked
$
iOS-specific checks
Keychain access groups & ACLs
Jailbreak detection bypass
Face ID / Touch ID flow tampering
App Transport Security (ATS) audit
Core Data & UserDefaults inspection
URL scheme & Universal Link abuse
Embedded provisioning & entitlements
Background mode & extension abuse
03 / OWASP Mobile Top 10 (2024)

The mobile-specific
attack catalogue.

Click any category to see what we actually probe, not just what the spec says.

M1
Improper Credential Usage
M2
Inadequate Supply Chain Security
M3
Insecure Authentication / Authorization
M4
Insufficient Input / Output Validation
M5
Insecure Communication
M6
Inadequate Privacy Controls
M7
Insufficient Binary Protections
M8
Security Misconfiguration
M9
Insecure Data Storage
M10
Insufficient Cryptography
M1 / OWASP Mobile 2024

Improper Credential Usage

Hardcoded API keys, embedded credentials, tokens in source, or insecure credential transmission. We grep, decompile, and dynamically extract.

Observed in our engagementsCRITICAL · 88%
Potential Impact
  • Full backend API compromised without user interaction
  • Authentication bypassed for all registered users
  • Credentials reused to pivot into cloud infrastructure
  • Vendor or third-party account takeover
04 / Methodology

Three layers of attack.

Static finds the obvious. Dynamic finds the runtime. Network finds the real damage.

STATIC

Decompile & inspect

We reverse the app binary and examine every piece of code, configuration, and embedded data. Secrets, weak crypto, and insecure permissions all become visible at this layer.

  • Credentials and API keys found before release
  • No runtime needed — works on any build
  • Full coverage including third-party SDKs
DYNAMIC

Hook the runtime

On a real rooted device we inject into the running app to observe what it does in practice. Bypass protections and in-memory secrets are only visible when the app is actually running.

  • Root and jailbreak detections bypassed
  • Secrets that never appear in code are captured
  • Exact runtime behavior observed and exploited
NETWORK

Intercept & abuse

With certificate pinning bypassed, every API call is visible and fully testable. We apply the complete OWASP API Top 10 against the backend your app depends on.

  • All app-to-server traffic captured and reviewed
  • API vulnerabilities found at the source
  • Authentication flaws discovered before attackers do
05 / Standards Alignment

Mapped to the standards your auditors reference.

OWASP MASVS
Mobile App Sec
OWASP MASTG
Testing Guide
ISO 27001
Annex A.14
GDPR
Art. 32 · 25
PCI MPoC
Evidence support
HIPAA
164.312
App Store
§5.1 Privacy support
Play Store
Data Safety form
06 / Engagement Process

From IPA upload to attestation.

Click a phase to see what happens and what you'll see in your terminal.

01

Scope & Build Handover

Day 0
A 30-minute scoping call locks the platform list, build versions, test accounts, backend environments, and rules of engagement.
02

Static Recon

Day 1–2
We decompile, baseline the binary, audit the manifest/Info.plist, fingerprint every SDK, and grep for embedded secrets, debug flags, and cryptographic missteps.
03

Dynamic Testing

Day 3–N
On a rooted Android device and jailbroken iPhone we hook the runtime with Frida, bypassing protections, tampering with logic, and dumping in-memory secrets.
04

API & Network

Day N–N+2
With pinning out of the way, we replay, fuzz, and abuse every API call. OWASP API Top 10 applied in full, plus mobile-specific concerns like push token forgery.
05

Report & Retest

After fix
A technical report mapped to MASVS controls, with reproducible PoCs, video captures, and a remediation playbook. Free retest verifies every fix.
~/mobile/01● Day 0
>> defining platforms · features · ROE
>> received: ClientPay-v4.2.1.apk · ClientPay-v4.2.1.ipa
>> test accounts provisioned · backend endpoints listed
$
07 / Deliverables

What lands on your desk.

A pentest is only as valuable as the artifact you ship to your team.

mobile-pentest-report.pdf
v1.0 · 58 pages · MASVS mapped
CONFIDENTIAL
Severity Distribution
Critical
4
High
9
Medium
8
Low
3
  • Executive summary (non-technical, 1-page)
  • Per-finding: CVSS, CWE, MASVS reference, evidence, PoC
  • Frida scripts & API replay collections included
  • Step-by-step platform-aware remediation guidance

Free Retest, Included

One full retest within 60 days of report delivery, included. We re-validate each finding on the rebuilt IPA/APK; a second pass is available if first-pass remediation is partial.

Attestation Letter

A signed letter referencing MASVS controls — for partners, customers, and auditors during procurement and security reviews.

Frida Scripts & PoCs

Every dynamic finding ships with the actual Frida hook and a video PoC. Your devs can reproduce in minutes.

Free · 45 min · No pressure

Start with a free consultation.

A 45-minute call with a Semicolon cybersecurity expert. We’ll learn about your company, your services, and your cybersecurity needs, then explain exactly what an engagement with Semicolon would look like. No deck, no sales rep, no commitment.

  • Talk to the actual expert
  • Walk through your architecture & risks
  • Get a tailored scoping proposal
SC
Semicolon Security
Online now
Replies in < 24h
Type your question...
Let's talk →